| View previous topic :: View next topic |
| Author |
Message |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Fri Mar 02, 2007 2:52 pm Post subject: re-finding addresses after update? |
|
|
| I was wondering if there is any easy way of finding addresses that have changed due to an update/version change? other than starting from scratch. Thanks!
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 25975 Location: The netherlands
|
Posted: Fri Mar 02, 2007 2:55 pm Post subject: |
|
|
Find one address, select it in the found address list. Rightclick the old address and choose recalculate addresses. That will then adjust the change in bytes to all other addresses as well.
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Fri Mar 02, 2007 3:19 pm Post subject: |
|
|
| Thanks! but i was meaning the codes/instructions, like would there be a way of finding where Code: 0053959d - 8b 98 b0 00 00 00 - mov ebx,[eax+000000b0] has moved to?
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 25975 Location: The netherlands
|
Posted: Fri Mar 02, 2007 3:25 pm Post subject: |
|
|
ah, kinda the same method, find one code and compare it to the old and and adjust the difference on the others. With luck a few (probably not all) will then match.
code is more difficult since that gets rebuild on a update, changing addresses, order or the functions, shortjumps become long longs, etc...
(you could try a array of byte scan for the bytes of the old instruction , preferably with some bytes of the instructions before and after it as well)
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
Davethewave Expert Cheater
Reputation: 0
Joined: 06 Mar 2005 Posts: 210
|
Posted: Fri Mar 02, 2007 5:12 pm Post subject: |
|
|
| Nice!! thanks allot =) It wasn't exact but it came close enough for me to find it in the disassembler
|
|
| Back to top |
|
 |
|